What Is EDR
Detect threats on endpoints.
What Is EDR is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is an Endpoint
An endpoint is any device that connects to a network: laptops, desktops, servers, and phones.
Endpoints are where users work and where attackers often gain their first foothold.
What Is EDR
EDR stands for Endpoint Detection and Response.
It is software that continuously monitors endpoints to detect suspicious activity and help teams respond to threats.
The EDR Agent
EDR works through a small program called an agent installed on each endpoint.
The agent watches processes, files, and network connections, then sends data to a central platform.
Continuous Monitoring
Unlike a one-time scan, EDR records activity all the time.
This continuous visibility lets analysts see exactly what happened before, during, and after an attack.
Detecting Behavior, Not Just Files
Traditional tools look for known bad files. EDR also watches behavior.
- A document spawning a command shell
- A process trying to read many files quickly
- Unusual outbound connections
Catching Unknown Threats
Because EDR focuses on actions, it can flag attacks that have never been seen before.
This helps against zero-day threats and fileless malware that leave no obvious file to scan.
Alerts and Investigation
When something looks wrong, EDR raises an alert.
Analysts then investigate using the recorded timeline to decide whether it is a real threat or a false alarm.
The Response Part
EDR does not just detect, it helps act.
- Isolate an infected machine from the network
- Kill a malicious process
- Quarantine a harmful file
This stops an attack from spreading.
Central Dashboard
All endpoint data flows into a central console.
From one dashboard, a security team can view alerts across thousands of devices and respond without touching each machine physically.
EDR and the SOC
A Security Operations Center (SOC) is the team that watches for threats.
EDR is one of their key tools, feeding alerts and evidence that drive faster, smarter decisions.
EDR, XDR, and MDR
You may hear related terms:
- EDR - focused on endpoints
- XDR - extends across email, network, and cloud
- MDR - a managed service run by outside experts
Quick Check
Test your understanding of EDR fundamentals.
Recap
EDR provides:
- A lightweight agent on each endpoint
- Continuous, behavior-based detection
- Tools to investigate and respond from a central console
It is a core part of modern endpoint defense and the SOC.
Frequently asked questions
Is the “What Is EDR” lesson free?
Yes — the full text of “What Is EDR” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “What Is EDR”?
Detect threats on endpoints. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “What Is EDR” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.